In decode_ics of aac_decoder.c, the max_sfb field is read directly from the AAC bitstream as an unvalidated 6-bit value (0-63) and used as a loop bound when populating the sfb_top and sf_val stack arrays, which are only sized for AAC_MAX_SFB (51) entries. A crafted AAC frame with max_sfb greater than 51 causes both stack arrays to be written past their bounds, and also causes an out-of-bounds read of the static sfb44 lookup table. This is reachable by decoding any attacker-supplied .m4a or .aac audio file through the media player.
CWE-787, CWE-121, CWE-125
Artfical DT Developer Talha Berk Arslan